Scribd
Upload
387 views4 pages

3310

This document describes how to decode GSM messages from a Nokia 3310 phone using Gsmdecode and a Gammu trace log. It provides instructions on the hardware and software needed, including installing Gammu and Gsmdecode, and connecting the phone to log and view the trace file. The trace can be analyzed to decode messages and view things like IMSI numbers and location codes from the trace data.

Uploaded by

p45ch4
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
387 views4 pages

3310

This document describes how to decode GSM messages from a Nokia 3310 phone using Gsmdecode and a Gammu trace log. It provides instructions on the hardware and software needed, including installing Gammu and Gsmdecode, and connecting the phone to log and view the trace file. The trace can be analyzed to decode messages and view things like IMSI numbers and location codes from the trace data.

Uploaded by

p45ch4
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 4

== GSM decoding with Nokia 3310 phone ==

Gsmdecode is used to decode the gsm messages from the gammu trace log and a Noki
a DCT3 mobile phone. Nokia used a simple remote logging facility for debugging t
heir DCT3 firmwares remotely, but apparently forgot to remove this when going in
to production. So you can enable it back with a special software described below
.
'''Hardware needed'''
* mobile phone Nokia 3310 (900/1800mhz) or 3390 (1900mhz)
* [http://www.cellphoneshop.net/usbdatcabfor.html F-BUS and M2BUS Auto switchin
g cable]
[[Image(nokia3310_nk-33.png)]]
'''Software needed'''
In Linux (for instance Ubuntu) we need to install gammu (from console):
{{{
sudo apt-get install gammu
sudo apt-get install dialog
}}}
Then we need to setup gammu:
{{{
gammu-config
}}}
Sometimes gammu-config doesn't work correctly and switches ''model'' and ''conne
ction'', so we must edit ~/.gammurc file:
{{{
nano ~/.gammurc
}}}
File must have the following content:
{{{
[gammu]
port = /dev/ttyS0
model = 6110
connection = mbus
synchronizetime = yes
logfile =
logformat = nothing
use_locking = yes
gammuloc =
}}}
Then we create subdirectory for data files...
{{{
mkdir ~/GSM
cd ~/GSM
}}}
...and either download and install Wireshark 1.1.2 or later [http://www.wireshar
k.org]
...or alternatively use gsmdecode; download source code of [http://wiki.thc.org/
gsm#head-bc727181581bac3b29b29f33fb1e14150ba12b82 gsmdecode-0.7bis.tar.gz] ([att
achment:gsmdecode-0.7bis.tar.gz direct download here]), extract it and compile i
t:
{{{
cd gsmdecode-0.7bis/
sudo apt-get install gcc g++ cpp gpp make automake
./configure
make all
}}}
According to THC wiki, ''gsmdecode'' has:
* SIM Toolkit support
* Concatenated SMS supported (e.g. sms longer than 140 octets).
* Service request support (e.g. *#100# requests).
* Other layer 3 support (long (23+ octet) RR messages, ...)
Now we need file ''nhm5_587.txt'' which helps us decode trace types and save it
to GSM subdirectory. File was found here:
* [http://arch.cihar.com/[email protected]/gammu--upstream--0/patch-2
9/gammu--upstream--0--patch-29.patches.tar.gz arch.cihar.com in tar.gz datafile]
* we need toopen datafile and find the following directory: /gammu upstream 0 patch-2
9.patches/new-files-archive/gammu/depend/dct3trac/
* there is a file ''nhm5_587.txt'', which needs to be saved into GSM subdirecto
ry.
However, you cah simply download file here:
* [attachment:nhm5_587.txt nhm5_587.txt]
'''How to connect the hardware'''
We need to open Nokia mobile phone, take out the battery, insert SIM card, inser
t battery into cable and then connect cable to the mobile phone.
The other part of the cable should be connected to computer (COM port - /dev/tty
S0), or we use USB to serial converter for instance USB-serial DB09 Aten (then w
e have emulated serial port under Linux - /dev/ttyUSB0).
Now we can switch on the mobile phone and start recording trace log.
[[Image(nokia_connect.png)]]

'''Logging the ''tracelog'' '''


''Please note that this step could be leggaly problematic, so I did not run the
following code, however, there are [http://wiki.thc.org/gsm/debugtrace some trac
es available on the internet]:''
{{{
cd ~/GSM
gammu --nokiadebug nhm5_587.txt v20-25,v18-19
}}}

'''Viewing the ''tracelog'' in Wireshark '''


The files can be loaded directly by Wireshark 1.1.2 or later:
{{{
wireshark ~/GSM/out.xml
}}}
'''Decoding the ''tracelog'' '''
Simple decoding (''output is printed on screen''):
{{{
~/GSM/gsmdecode-0.7bis/src/gsmdecode -x <~/GSM/out.xml
}}}
If you are interested in the [http://en.wikipedia.org/wiki/Broadcast_Control_Cha
nnel BCCH messages] (BCCH - Broadcast Control Channel carries a repeating patter
n of system information messages that describe the identity, configuration and a
vailable features of the [http://en.wikipedia.org/wiki/Base_Transceiver_Station
BTS] (Base transceiver station), run ''gsmdecode'' with the '''-i command'''. Th
ese messages also provide a list of ARFCN's used by neighboring BTS's. Printed o
ut is BBis LAPDm frame format, Immediate Assignment, etc.
{{{
~/GSM/gsmdecode-0.7bis/src/gsmdecode -i <~/GSM/out.xml
}}}

'''List of "catched" IMSI numbers with frequency of IMSI number in tracelog:'''


''Please note that this is theory only, because I did not run the tracelog comma
nd:''
{{{
~/GSM/gsmdecode-0.7bis/src/gsmdecode -x <~/GSM/out.xml | grep 7/odd | awk '{ pri
nt $5 }' | sort | uniq -c
}}}
'''Someone could do tracelog while driwing (''wardriving'') and collect Local Ar
ea Codea which could be printed out:'''
''Please note that this is theory only, because I did not run the tracelog comma
nd:''
{{{
~/GSM/gsmdecode-0.7bis/src/gsmdecode -x <out.xml | grep "Local Area Code" | awk
'{ print $3 }'
}}}

'''Possible bugs'''
1) The 3390b was not supported in gammu until today. The nokiadebug command woul
d quit without an error. [https://bugs.cihar.com/view.php?id=982 See this bug]
2) I'm currently receiving a segmentation fault (gammu 1.25.92) after making pho
ne calls. If I add a "break;" after case 0x22 and case 0x23 in gammu/depend/noki
a/dct3trac/wmx.c it is possible to prevent the crash from happening. It seems to
be related to decoding SIM commands. [https://bugs.cihar.com/view.php?id=983 He
re is the bug report]
'''Sample traces'''
''See sample traces in XML format in an attachments below. Sample traces are fro
m old website.''
* [attachment:call_1525.xml call_1525.xml] - mobile phone called the number 152
5 and stayed connected for 2-3 seconds. The xml file contains uplink and downlin
k traffic as sniffed by default DCT3 tracer.
* [attachment:call_init.xml call_init.xml] - call init
* [attachment:sms.xml sms.xml] - SMS trace log
* [attachment:sms2.xml sms2.xml] - SMS containing "abc"
* [http://wiki.thc.org/gsm/debugtrace other traces] - from old webpage

You might also like